Not only wrong, but a security bug!